UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,342
Published in 7 days
813
Critical in 30 days
327
Actively exploited
422
Clear filters

Results for “wordpress”

2,743 vulnerabilities
  1. Medium 5.4

    CVE-2026-110901 · Smartcrawl SEO (WordPress plugin)

    WordPress SmartCrawl plugin <= 3.16.4 - Insecure Direct Object References (IDOR) vulnerability

    Published 16 Oct 2026 · CVE Program
  2. Medium 5.3

    CVE-2026-110380 · WP Event Solution (WordPress plugin)

    WordPress WP Event Solution plugin <= 4.1.26 - Broken Access Control vulnerability

    Published 16 Oct 2026 · CVE Program
  3. Medium 6.5

    CVE-2026-111405 · Mapsvg Lite Interactive Vector Maps (WordPress plugin)

    WordPress MapSVG plugin <= 8.16.1 - Cross Site Scripting (XSS) vulnerability

    Published 16 Oct 2026 · CVE Program
  4. High 8.5

    CVE-2026-111399 · Mapsvg Lite Interactive Vector Maps (WordPress plugin)

    WordPress MapSVG plugin <= 8.16.1 - SQL Injection vulnerability

    Published 16 Oct 2026 · CVE Program
  5. Medium 5.3

    CVE-2026-111397 · Mapsvg Lite Interactive Vector Maps (WordPress plugin)

    WordPress MapSVG plugin <= 8.16.1 - Sensitive Data Exposure vulnerability

    Published 16 Oct 2026 · CVE Program
  6. High 7.2

    CVE-2026-107648 · Activitytime (WordPress plugin)

    WP Sessions Time Monitoring Full Automatic <= 1.1.5 - Unauthenticated Stored Cross-Site Scripting via 'action' GET Parameter

    Published 16 Oct 2026 · CVE Program
  7. Medium 5.4

    CVE-2026-107649 · Events Made Easy (WordPress plugin)

    Events Made Easy <= 3.2.22 - Unauthenticated Stored Cross-Site Scripting via 'event[location_name]' Parameter

    Published 16 Oct 2026 · CVE Program
  8. Medium 6.4

    CVE-2026-110703 · Geodirectory (WordPress plugin)

    GeoDirectory <= 2.8.191 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_content' Parameter via data-embed-url Attribute

    Published 16 Oct 2026 · CVE Program
  9. Medium 5.4

    CVE-2026-104003 · WP User Avatar (WordPress plugin)

    Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.5 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Comment Content Rendered on ProfilePress User Profile 'Comments' Tab

    Published 16 Oct 2026 · CVE Program
  10. High 7.5

    CVE-2026-92766 · Vitepos Lite (WordPress plugin)

    Vitepos <= 3.5.1 - Unauthenticated SQL Injection via 'src_by' Parameter

    Published 16 Oct 2026 · CVE Program
  11. Medium 6.4

    CVE-2026-104726 · Name Directory (WordPress plugin)

    Name Directory <= 1.34.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'dir' Shortcode Attribute

    Published 16 Oct 2026 · CVE Program
  12. High 7.2

    CVE-2026-109224 · Surecart (WordPress plugin)

    SureCart <= 4.9.4 - Unauthenticated Stored Cross-Site Scripting via sc-cart-loader 'template' Attribute in Comment

    Published 16 Oct 2026 · CVE Program
  13. Medium 6.4

    CVE-2026-93681 · Tutor (WordPress plugin)

    Tutor LMS <= 4.1.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via display_name Parameter

    Published 16 Oct 2026 · CVE Program
  14. High 8.8

    CVE-2026-111311 · Doublescale (WordPress plugin)

    DoubleScale | All-in-One CRM <= 1.5.1 - Authenticated (Subscriber+) Arbitrary File Upload via Portal 'ticketless' Attachment Endpoint

    Published 16 Oct 2026 · CVE Program
  15. Medium 6.4

    CVE-2026-96870 · Suredash (WordPress plugin)

    SureDash <= 1.12.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' Parameter

    Published 16 Oct 2026 · CVE Program
  16. Medium 6.4

    CVE-2026-100108 · Share Button (WordPress plugin)

    Social Share Buttons <= 1.30 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'share_url' Network Setting

    Published 16 Oct 2026 · CVE Program
  17. Medium 6.4

    CVE-2026-100106 · Ajax Search For Woocommerce (WordPress plugin)

    FiboSearch <= 1.34.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'purchased_plan' Parameter

    Published 16 Oct 2026 · CVE Program
  18. High 8.1

    CVE-2026-75903 · Vulnity (WordPress plugin)

    Vulnity Security <= 1.4.3 - Unauthenticated Authentication Bypass to Administrator via Exposed Pairing Credentials

    Published 16 Oct 2026 · CVE Program
  19. Critical 10.0

    CVE-2026-94169 · The Grid (WordPress plugin)

    WordPress The Grid plugin <= 2.8.1 - Remote Code Execution (RCE) vulnerability

    Published 16 Oct 2026 · CVE Program
  20. Critical 9.3

    CVE-2026-94388 · Halfdata Green Popups (WordPress plugin)

    WordPress Green Popups plugin < 7.6.3 - SQL Injection vulnerability

    Published 16 Oct 2026 · Fixed in 7.6.3 · CVE Program
  21. High 8.1

    CVE-2026-97296 · Gravityforms (WordPress plugin)

    WordPress Gravity Forms plugin < 3.1.1 - PHP Object Injection vulnerability

    Published 16 Oct 2026 · Fixed in 3.1.1 · CVE Program
  22. High 7.1

    CVE-2026-96339 · Houzez (WordPress plugin), Houzez (WordPress theme)

    WordPress Houzez theme <= 4.4.0 - Cross Site Scripting (XSS) vulnerability

    Published 16 Oct 2026 · CVE Program
  23. Medium 5.3

    CVE-2026-110366 · Site Reviews (WordPress plugin)

    WordPress Site Reviews plugin <= 8.3.4 - Broken Access Control vulnerability

    Published 16 Oct 2026 · CVE Program
  24. High 8.8

    CVE-2026-92115 · WP Photo Album Plus (WordPress plugin)

    WP Photo Album Plus <= 9.3.02.002 - Authenticated (Custom+) Command Injection via 'value' Parameter (crop item) in update-photo AJAX Action

    Published 16 Oct 2026 · CVE Program
  25. Medium 5.4

    CVE-2026-15222 · User Registration (WordPress plugin)

    User Registration & Membership <= 5.2.8 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via display_name

    Published 16 Oct 2026 · CVE Program
  26. Low 2.7

    CVE-2026-109401 · WP Mail Logging (WordPress plugin)

    WP Mail Logging <= 1.17.0 - Authenticated (Administrator+) Sensitive Information Exposure in LIKE Wildcard in Personal Data Export Email

    Published 16 Oct 2026 · CVE Program
  27. High 7.2

    CVE-2026-97640 · Wpconsent Cookies Banner Privacy Suite (WordPress plugin)

    WPConsent <= 1.1.9 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Simple HTML DOM Parser Noise-Key Restoration (mXSS)

    Published 16 Oct 2026 · CVE Program
  28. Medium 5.4

    CVE-2026-110252 · Wpematico (WordPress plugin)

    WPeMatico RSS Feed Fetcher <= 2.9 - Unauthenticated Stored Cross-Site Scripting via RSS Feed Content Import

    Published 16 Oct 2026 · CVE Program
  29. High 7.2

    CVE-2026-109193 · Hivepress (WordPress plugin)

    HivePress <= 1.7.32 - Unauthenticated Stored Cross-Site Scripting via Custom User Attribute Value

    Published 16 Oct 2026 · CVE Program
  30. Critical 9.8

    CVE-2026-104730 · Sunshine Photo Cart (WordPress plugin)

    Sunshine Photo Cart <= 3.7.4 - Unauthenticated PHP Object Injection via 'key' Parameter

    Published 16 Oct 2026 · CVE Program
  31. Medium 4.3

    CVE-2026-19798 · WP Map Block (WordPress plugin)

    WP Map Block <= 3.0.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Map Publish/Unpublish/Delete via set_status() and bulk() REST Endpoints

    Published 16 Oct 2026 · CVE Program
  32. Medium 6.5

    CVE-2026-109382 · Wsp Mcp AI Agents Connector (WordPress plugin)

    WSP MCP <= 2.9.5 - Authenticated (Subscriber+) Sensitive Information Disclosure via Broken Access Control to 'wsp_get_posts' MCP Tool

    Published 16 Oct 2026 · CVE Program
  33. Medium 4.8

    CVE-2026-104755 · WP Compress Image Optimizer (WordPress plugin)

    WP Compress <= 7.25.00 - Unauthenticated Privilege Escalation to 'group'/'setting'/'value' Parameters on comms Endpoint

    Published 16 Oct 2026 · CVE Program
  34. Medium 6.4

    CVE-2026-109388 · Hivepress (WordPress plugin)

    HivePress <= 1.7.32 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'message' Attribute of the hivepress_user_login_form Shortcode

    Published 16 Oct 2026 · CVE Program
  35. Medium 6.4

    CVE-2026-110290 · Top 10 (WordPress plugin)

    WebberZone Top 10 <= 4.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'other_attributes' Block Attribute

    Published 16 Oct 2026 · CVE Program
  36. High 8.8

    CVE-2026-92553 · Yaysmtp (WordPress plugin)

    YaySMTP <= 2.7.7 - Authenticated (Subscriber+) Arbitrary File Upload via Attachment Filename Extension

    Published 16 Oct 2026 · CVE Program
  37. Medium 6.4

    CVE-2026-111069 · Geodirectory (WordPress plugin)

    GeoDirectory <= 2.8.192 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'twitterusername' Custom Field

    Published 16 Oct 2026 · CVE Program
  38. Medium 6.8

    CVE-2026-107770 · Wplr Sync (WordPress plugin)

    Photo Engine (Media Organizer & Lightroom) <= 6.5.6 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion and Upload via /?wplr-sync-api 'delete' / 'sync' action

    Published 16 Oct 2026 · CVE Program
  39. Medium 6.4

    CVE-2026-110664 · Wpdm Premium Packages (WordPress plugin)

    Premium Packages <= 7.2.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Order Notes

    Published 16 Oct 2026 · CVE Program
  40. High 7.2

    CVE-2026-110701 · Cp Multi View Calendar (WordPress plugin)

    CP Multi View Events Calendar <= 1.4.42 - Unauthenticated Stored Cross-Site Scripting via 'CalendarTitle' Parameter

    Published 16 Oct 2026 · CVE Program
  41. Medium 4.9

    CVE-2026-111178 · WP Booking System (WordPress plugin)

    WP Booking System <= 2.1.0.1 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter

    Published 16 Oct 2026 · CVE Program
  42. Medium 5.3

    CVE-2026-107646 · Woocommerce Products Filter (WordPress plugin)

    HUSKY <= 1.4.5 - Unauthenticated Sensitive Information Exposure in 'woof_tm_data' Localized Script

    Published 16 Oct 2026 · CVE Program
  43. High 7.2

    CVE-2026-100186 · Profile Builder (WordPress plugin)

    User Profile Builder <= 4.0.3 - Unauthenticated Stored Cross-Site Scripting via First Name Field

    Published 16 Oct 2026 · CVE Program
  44. Medium 6.1

    CVE-2026-88963 · Tutor (WordPress plugin)

    Tutor LMS <= 4.0.8 - Authenticated (Subscriber+) Reflected DOM-Based Cross-Site Scripting via 'redirect_url' Parameter

    Published 16 Oct 2026 · CVE Program
  45. High 8.8

    CVE-2026-85659 · Pilotpress (WordPress plugin)

    PilotPress <= 2.0.43 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover via 'username' Parameter

    Published 16 Oct 2026 · CVE Program
  46. High 7.2

    CVE-2026-109513 · Notificationx (WordPress plugin)

    NotificationX <= 3.3.3 - Unauthenticated Stored Cross-Site Scripting via 'name' Parameter via popup-submit REST Route

    Published 16 Oct 2026 · CVE Program
  47. Medium 6.5

    CVE-2026-109414 · Vitepos Lite (WordPress plugin)

    Vitepos <= 3.6.1 - Authenticated (Vendor+) SQL Injection via 'src_by[].val' Parameter via 'bt' Operator

    Published 16 Oct 2026 · CVE Program
  48. High 7.2

    CVE-2026-107764 · So CSS (WordPress plugin)

    SiteOrigin CSS <= 1.6.7 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Author URL via Inspector href Sink

    Published 16 Oct 2026 · CVE Program
  49. High 7.2

    CVE-2026-111122 · So CSS (WordPress plugin)

    SiteOrigin CSS <= 1.6.7 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Anchor href via Visual Inspector

    Published 16 Oct 2026 · CVE Program
  50. Critical 9.8

    CVE-2026-103768 · Elex Helpdesk Customer Support Ticket System (WordPress plugin)

    ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.7 - Unauthenticated Arbitrary File Upload via IMAP Email Attachment

    Published 16 Oct 2026 · CVE Program

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.